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Information Commissioner’s Office 


Management Board minutes 
Monday 27 January 2014 


Members and other attendees present 


Daniel Benjamin Director of Corporate Services 

Simon Entwisle Director of Operations 

Christopher Graham Information Commissioner (chair) 

Andrew Hind Non-executive Director 

Neil Masom Non-executive Director 

David Smith Deputy Commissioner Data Protection 

Graham Smith Deputy Commissioner Freedom of 
Information 

Ian Watmore Non-executive Director 

David Wells Head of IT (agenda item 5 only) 

Peter Bloomfield Senior Corporate Governance Manager 


(secretariat) 


1. Introductions and apologies 


1.1. There was an apology from Enid Rowlands who was 
unable to attend the meeting. 


2. Declaration of interests 
2.1. There were no new declarations of interest. 


3. Matters arising from the meeting of 4 November 


3-1. The two outstanding action points from previous 
meetings were considered. The first was to ensure that ICO 
Plan actions were smarter; meaning that wherever possible 
tangible outcomes would be assigned to the objectives 


concerned. The draft ICO Plan was to be discussed later in 
the meeting. 


3.2. The second was to consider how best to identify 
efficiencies in data protection work. Simon Entwisle advised 
the Board that work was ongoing. For example, as part of 
talks about an information rights fee, how best to cost 
various ICO activities had been discussed with the Ministry of 
Justice (MOJ). Areas looked at had included the cost of ICO 
prosecutions which had a wide range. And it was expected 
that the cost per freedom of information case would reduce. 


Action point 1: Simon Entwisle to bring a paper on data 
protection costs based on 2013/14 figures to the next 
Management Board meeting. 


3.3. Clarification was sought on the cleared action, to discuss 
with the National Audit Office (NAO) whether or not civil 
monetary penalties paid to the ICO could be offset against 
costs of collection. The NAO had confirmed that they could 
not be; legislation was such that all of the money collected 
had to go to the consolidated fund. 


3.4. The new format for the outstanding action points was 
liked. 


Action point 2: Peter Bloomfield to include 
Remuneration Committee actions in the register of 
outstanding action points. 


4. Commissioner’s forward look and the risk register 


4.1. The Commissioner reported on major issues affecting 
the ICO. Matters raised included the ongoing consultation on 
the ICO’s high level statement of travel “Looking ahead, 
staying ahead” which closes on 7 February. A Town Hall 
meeting with all staff was arranged for the week afterwards 
to feed back on the 2020 vision work started last year. 


4.2. The Commissioner also reported back on his recent 
meeting with Simon Hughes MP, the new Minister of State for 
Justice and Civil Liberties. The Minister had agreed to be a 
key note speaker at the forthcoming Data Protection 
Practitioners’ Conference in March and would like to visit the 
Wilmslow office at some point. There was a need for the ICO 
to be clear about (and to discuss) any legislative changes it 
wanted. 


4.3. ICO accommodation and the factors which would have 
an impact on decisions were discussed. These included 
recruitment and the affect on current staff from any move. 


4.4. The rollout of care.data was one of the big issues in 
which the ICO was involved in. However it was noted that the 
Data Protection Act was not the main governing legislation 
steering how the project was handled. Other specific 
legislation about the project existed. This meant the ICO had 
to be clear about its role and remit when making statements 
on the project. The main concern was that patient data might 
not be fully anonymised. 


4.5. Criteria had been developed to help inform decisions on 
ICO involvement in different projects and areas. The criteria 
were considered useful. In respect of affordability, whilst it 
was desirable to have funding for new work this might not 
necessarily be the deciding factor in all cases. Coherence with 
the work of the ICO (or proximity to and consistency with) 
were also important. 


Action point 3: ET to finalise the paper “Our Approach 
to Additional Regulatory Functions” and to build in a 12 
month review. 


4.6. The risk register was considered. It was noted that the 
register was static and needed a re-fresh once the ICO Plan 
2014-2017 was agreed; ie in March. In respect of the 
European Regulation, given the low probability of the 
proposed Regulation now coming into being it was felt that it 
was unlikely that there would be any changes to the 
European data protection legislative framework until 2018 at 
the earliest. 


Action point 4: Peter Bloomfield to ensure that ET 
reviews the risk register in light of the developing 
plans for 2014/15 and beyond, by the end of March. 


5. IT Strategy 


5.1. David Wells, Head of IT, attended to present the IT 
Strategy. It was a slightly amended version of the one 
presented to the last Audit Committee. The need to tie the 
strategy into business need had been taken on board and 
Simon Entwisle confirmed that operational need was 
supported. 


5.2. Recruitment in IT was a problem; there was a shortage 
of specialist staff which drove the cost up. 


5:3: It was difficult at present to compare costs year on year 
given the change in the way IT was being run. However 
increasingly information on costs was improving. In particular 
it was noted that much of the costs in the IT budget related 


to expenditure which would not normally be considered as IT 
expenditure. 


5.4. The cost of providing IT for the ICO was large at £4m. It 
was suggested that the ICO had to be sure it was getting 
value for money from its IT expenditure and had also thought 
through what it could provide on more, or less, money. 
Linking IT expenditure to efficiencies was thought essential. 


5.5; The need to ensure that the reasons why the ICO could 
not source a cloud based finance system also had be clarified. 


Action point 5: Daniel Benjamin to finalise the IT 
strategy taking account of the comments made, by the 
end of March. 


Action point 6: Daniel Benjamin to look at the impact of 
a rise, or fall, in IT budget, by the end of March. 


6. Planning and budgeting 


6.1. The draft budget for 2014/15 was presented for 
discussion. Grant in aid (for freedom of information work) 
was yet to be confirmed but was expected to be £3.75m. The 
budget was therefore not expected to change substantially. 


6.2. Funding for 2015/16 was more uncertain and the MOJ 
was being asked for clarity on the plans for a proposed cut in 
regulators’ fees in 2015 and for increases in employer 
pension contributions. The lack of flexibility for the ICO to 
meet further cuts was noted. 


6.3. The ICO was to approach the MOJ for funding to support 
the Commissioner if elected to the chair of the Article 29 
Working Party. 


6.4. In respect of the draft ICO Plan 2014 - 2017, this would 
be firmed up in the next few weeks once the results of the 
consultation exercise on the ICO’s high level direction 
statement closed. 


6.5. It was agreed that ET would consider the wording of its 
“goal” when the consultation closed. There was also 
discussion about the aim to answer telephone calls to its 
helpline within one minute. The resource needed to improve 
this time would be disproportionate to the improvement in 
service, and customer surveys had not suggested that the 
wait was a big problem. 


6.6. Succession planning was noted as being an important 
strand of work that needed to be seen through over the next 
12-18 months and it was agreed that this should be reflected 


in the Plan. This would cover not only the implications of the 
Commissioner reaching the end of his term in 2016 but also 
likely changes among Board members in the medium term. 


7. Management Board self assessment and changes to 
other committees’ terms of reference 


Zal: The terms of reference for the Remuneration Committee 
were considered in detail. It was felt to be the least visible 
and understood of the ICO committees. It meets twice a year 
and its minutes come to Management Board. However, it was 
thought that it would be beneficial if other Board colleagues 
attend Remuneration Committee meetings from time to time 
to build a broader understanding of the issues it covers and 
its role. 


Action point 7: Christopher Graham to discuss with 
colleagues how to develop a greater understanding of 
the Remuneration Committee's work; and to report 
back to the next Management Board. 


7.2. It was agreed not to change the wording of the 
Remuneration Committee’s purpose in its terms of reference. 
It was felt that doing so was not necessary given the more 
detailed sections in the terms of reference. 


7:3: It was agreed to amend para 2.5.13 to say that the 
committee shall “Consider any other relevant matters as 
raised by the Commissioner”; but not to include the 
Commissioner as a member. Rather it was confirmed that the 
role of the Committee is to advise the Commissioner. 


7.4. Two minor changes to the ET terms of reference were 
also agreed. These were to reflect the replacement of the 
Statement on Internal Control in the annual report by a 
Governance Statement, and to add “Staff leadership and 
development” to its (and Management Board’s) 
responsibilities. 


7:5: Finally minor amendments (one noted above) were 
agreed to the Management Board terms of reference. 


Action point 8: Peter Bloomfield to revise the terms of 
reference as agreed by 31 January. 


8. Governance Statement 


8.1. Peter Bloomfield tabled a draft template for the 
Governance Statement which was to be included as part of 
the ICO’s Annual Report. It was tabled to ensure that Board 


members knew about the statement and the proposed format 
for it. 


9. Performance against the ICO Plan 2013-2016 


9.1. The report on performance against the current ICO Plan 
was presented for information and discussion. Discussion 
focused on those areas with slippage. 


9.2. It was confirmed that it was still the intention to 
develop information rights training material for use by 
organisations when training their own staff; the project was 
however delayed due to resourcing problems and would now 
be completed by March 2015. 


9.3. Due to a lack of resources little had been done on 
promoting freedom of information to the public. 


9.4. The ICO was still pressing for changes to its funding 
model. The possible completion date had slipped from March 
to May 2014. 


10. Finances 


10.1. The income and expenditure report for December was 
presented for information and discussion. The ICO was in a 
reasonably good position this financial year as data protection 
fee income had recovered from its earlier drop. 


10.2. The departure of the Finance Manager to a new job was 
noted. An interim manager had been recruited pending an 
exercise to recruit a permanent Finance Manager. 


10.3. It was also noted that there had been a failure to recruit 
for the post of Head of People and Resources. ET was to 
reconsider the position. 


11. Issues reports 


11.1. Reports on Operations, information rights, Corporate 
Affairs, Organisational Development and IT areas were 
presented for information and discussion. 


11.2. In respect of Operations staffing levels had been stable 
over the year which had helped increases in productivity to 
meet increases in caseload. Project Eagle, looking at how 
data protection cases were assessed, was on track with roll 
out planned for April. 


11.3. In respect of Organisational Development it was 
reported that staff turnover for the ICO as a whole was up to 
(an extrapolated annual figure of) 10.5% 


12. Executive Team reports 


12.1. The minutes of ET meetings since the last Management 
Board were presented for information. 


13. Remuneration Committee 


13.1. The minutes of the last Remuneration Committee were 
presented for information. 


14. Audit Committee 


14.1. The minutes of the last Audit Committee were 
presented for information. 


14.2. Neil Masom, the chair of the Audit Committee, reported 
that in a private session at the last meeting the Committee 
had considered the recommendation to re-appoint Grant 
Thornton as the ICO’s internal auditors and had confirmed 
the appointment. When in private session the Committee had 
also considered the review of Corporate Services and a HR 
issue. Management had reviewed policies as a consequence 
of discussion at the session. 


15. Any other urgent business 


15.1. Christopher Graham confirmed that he had met with the 


non-executive director designate who was due to start in the 
role in August. 


